Documentation
¶
Overview ¶
Package backchannel implements the OIDC Back-Channel Logout plugin.
It handles POST /backchannel_logout (OIDC Back-Channel Logout §4), allowing the OP to send logout tokens to RPs via back-channel.
Index ¶
- func PushLogoutTokens(ctx context.Context, store storm.BackChannelStore, issuer string, ...) error
- func PushLogoutTokensWithClient(ctx context.Context, store storm.BackChannelStore, issuer string, ...) error
- type BackChannelLogoutClient
- type Plugin
- func (p *Plugin) Category() storm.PluginCategory
- func (p *Plugin) Contribute(ctx context.Context, cfg *protocol.DiscoveryConfiguration)
- func (p *Plugin) Name() string
- func (p *Plugin) PostLogout(ctx context.Context, userID, clientID, sid string)
- func (p *Plugin) Register(r chi.Router)
- func (p *Plugin) Requires() []string
- func (p *Plugin) SetIssuer(issuer string)
- func (p *Plugin) SetLogger(logger *slog.Logger)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func PushLogoutTokens ¶
func PushLogoutTokens(ctx context.Context, store storm.BackChannelStore, issuer string, signingKey storm.SigningKey, subject, sid string, logger *slog.Logger, skipTLSVerify bool) error
PushLogoutTokens sends logout tokens to all RPs that have sessions for the given subject and session ID (OIDC Back-Channel Logout §2.5).
This is the main entry point for triggering back-channel logout. Call this when a session is terminated (e.g., from endsession plugin).
func PushLogoutTokensWithClient ¶
func PushLogoutTokensWithClient(ctx context.Context, store storm.BackChannelStore, issuer string, signingKey storm.SigningKey, subject, sid string, logger *slog.Logger, httpClient *http.Client) error
PushLogoutTokensWithClient is like PushLogoutTokens but accepts a custom HTTP client for outbound requests (e.g., with TLS skip for testing).
Types ¶
type BackChannelLogoutClient ¶
BackChannelLogoutClient is optionally implemented by clients that support back-channel logout. When implemented, the plugin sends logout tokens to the client's back-channel logout URI.
type Plugin ¶
type Plugin struct {
// contains filtered or unexported fields
}
Plugin implements the OIDC Back-Channel Logout endpoint.
func New ¶
func New(ctx *storm.PluginContext) *Plugin
New creates a new BackChannel plugin from a PluginContext.
func (*Plugin) Category ¶
func (p *Plugin) Category() storm.PluginCategory
Category returns CategoryStandard — backchannel is optional but enabled by default.
func (*Plugin) Contribute ¶
func (p *Plugin) Contribute(ctx context.Context, cfg *protocol.DiscoveryConfiguration)
Contribute returns the discovery fields for the backchannel logout endpoint.
func (*Plugin) PostLogout ¶
PostLogout implements the LogoutHook interface for EndSession integration. When EndSession terminates a session, it calls this method to trigger back-channel logout to all registered RPs.
func (*Plugin) Register ¶
Register installs the POST /backchannel_logout route.
OIDC standard endpoint: POST /backchannel_logout (OIDC Back-Channel Logout §4)
Source Files